diff --git a/.custodian-brief.md b/.custodian-brief.md
index 0cdf917..5659b2c 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — secrets-engine
 
 **Domain:** infotech  
-**Last synced:** 2026-09-27 14:01 UTC  
+**Last synced:** 2026-09-27 14:16 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -12,35 +12,30 @@ Progress: 4/6 done  |  workplan_id: `31f7f8ea-7f73-516c-8877-f03a13f1db82`
 
 **Open tasks:**
 - ! Stage live apply and verification  `fb103f1e`
+  *(wait: OpenRouter key-check native acceptance is recorded in SECRETS-WP-0010-T03. Other lanes still need exact approvals, scoped attended apply and per-lane positive/negative/health/revocation evidence.)*
 - ! Reconcile routing ownership and retire interim proxies  `1431edae`
-
-### Multi-lane exec-owner delivery
-Progress: 4/5 done  |  workplan_id: `ecb0643d-bad7-5d63-b340-e77ab9579b0a`
-
-**Open tasks:**
-- ! Catalog the Activity Core worker token lane  `cf465065`
-  *(wait: Activity Core reports ACTIVITY-WP-0039 finished and metered identity authentication proved (2026-09-24). Remaining: admit the configured Glas owner, obtain exact per-lane approvals, and perform attended native apply/verify/delivery under SECRETS-WP-0009-T03.)*
+  *(wait: Needs owner-agreed routing/proxy retirement for each verified lane and custody disposition of the legacy npm pointer; a single approved OpenRouter key-check does not authorize broader routing cutover.)*
 
 ### Production-safe provisioning, authorization, and lifecycle hardening
-Progress: 5/7 done  |  workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3`
+Progress: 6/7 done  |  workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3`
 
 **Open tasks:**
-- ! Bind approvals to exact production actions  `4b58edec`
 - ! Resume native production lane adoption  `a0a1dd92`
+  *(wait: Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.)*
 
 ### Evolve the Lifecycle engine to the accepted security layer model
-Progress: 4/6 done  |  workplan_id: `9c9e5164-b2f5-5ea2-a557-5368d65e9fe0`
+Progress: 5/6 done  |  workplan_id: `9c9e5164-b2f5-5ea2-a557-5368d65e9fe0`
 
 **Open tasks:**
-- ! Consume access-engine decision records  `3eb9cff8`
 - ! No standing engine credential  `d7bc8bdc`
+  *(wait: RPF-WP-0035-T02 still awaits exact service claims/tenant, credential custody and scoped attended JWT role provisioning with native login/negative/revocation proof. The historical env-auth acceptance is not service-JWT adoption.)*
 
 ### Activate native Claude credential delivery for Glas
 Progress: 2/3 done  |  workplan_id: `40ccc3b4-d046-5a58-8649-e7935f45c974`
 
 **Open tasks:**
 - ! Activate the approved native lane and verify real owner delivery  `f8069c8a`
-  *(wait: Shared native chain proved by SECRETS-WP-0010-T03. Metered owner provisioned and binding drafted (2026-09-23); Activity Core reports identity live (2026-09-24). Remaining: current recipient/pin admission, unrelated negative identity, configured exec_owner, exact per-action/per-lane approvals and attended apply/verify/exec/revoke.)*
+  *(wait: Configured owner and worker companion passed backend-free recipient/pin checks on 2026-09-27 (SECRETS-WP-0011 complete). Remaining: exact per-action/per-lane approvals, unrelated negative identity, scoped attended apply/verify, bounded real owner delivery and revocation. Recheck pins and spend validity at execution.)*
 
 ---
 ## MCP Orientation (when available)